CVE Watch14 oct 2026

CVE-2020-10735

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take

CVSS

7.5

Alto

EPSS

4.5%

p92

KEV

—

Exploit Today

0-100

Publicado: 9 sept 2022 · Última mod.: 14 oct 2026 · CWE-704

EPSS · 30d

4.5%EPSS · 30 días4.5%

2026-10-172026-11-13

Descripción técnica

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-553482.3 BAJ

1.8%

——1In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a negative buffer size due to an improper or implicit cast. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.2d CVE-2026-172114.3 MED

40.0%

——12IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could cause the service to return invalid responses or become unavailable.7d CVE-2026-1223197.5 ALT

22.3%

——7Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement.5d CVE-2026-1027034.4 MED

3.7%

——1[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases: - Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703. - Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704.9d CVE-2026-1215895.3 MED

36.7%

——11A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUrlSigner.php of the component URL Validation. This manipulation of the argument expires causes incorrect type conversion. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.4 is able to address this issue. Patch name: 86af3355388210668f6bfbe9007bd6545d4942ad. It is recommended to upgrade the affected component.6d CVE-2026-1212625.3 MED

31.7%

——10A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.6d